Skip to content

Commit aebe210

Browse files
peterschrammelpeterschrammel
authored
Merge pull request #157 from viktormalik/svcomp22-fixes
SV-COMP fixes
2 parents 9c18c94 + 9071c90 commit aebe210

File tree

18 files changed

+300
-141
lines changed

18 files changed

+300
-141
lines changed

‎lib/cbmc‎

‎regression/kiki/hard2_unwindbound5/main.c‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
hardware integer division program, by Manna
3+
returns q==A//B
4+
*/
5+
6+
extern void abort(void);
7+
extern void __assert_fail(const char *, const char *, unsigned int, const char *) __attribute__ ((__nothrow__ , __leaf__)) __attribute__ ((__noreturn__));
8+
void reach_error() { __assert_fail("0", "hard2.c", 8, "reach_error"); }
9+
extern int __VERIFIER_nondet_int(void);
10+
extern void abort(void);
11+
void assume_abort_if_not(int cond) {
12+
if(!cond) {abort();}
13+
}
14+
void __VERIFIER_assert(int cond) {
15+
if (!(cond)) {
16+
ERROR:
17+
{reach_error();}
18+
}
19+
return;
20+
}
21+
22+
int counter = 0;
23+
int main() {
24+
int A, B;
25+
int r, d, p, q;
26+
A = __VERIFIER_nondet_int();
27+
B = 1;
28+
29+
r = A;
30+
d = B;
31+
p = 1;
32+
q = 0;
33+
34+
while (counter++<5) {
35+
__VERIFIER_assert(q == 0);
36+
__VERIFIER_assert(r == A);
37+
__VERIFIER_assert(d == B * p);
38+
if (!(r >= d)) break;
39+
40+
d = 2 * d;
41+
p = 2 * p;
42+
}
43+
44+
while (counter++<5) {
45+
__VERIFIER_assert(A == q*B + r);
46+
__VERIFIER_assert(d == B*p);
47+
48+
if (!(p != 1)) break;
49+
50+
d = d / 2;
51+
p = p / 2;
52+
if (r >= d) {
53+
r = r - d;
54+
q = q + p;
55+
}
56+
}
57+
58+
__VERIFIER_assert(A == d*q + r);
59+
__VERIFIER_assert(B == d);
60+
return 0;
61+
}

‎regression/kiki/hard2_unwindbound5/test.desc‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
CORE
2+
main.c
3+
--heap --values-refine --k-induction --competition-mode
4+
^EXIT=10$
5+
^SIGNAL=0$
6+
^.*FAILURE$
7+
--
8+
--
9+
This is a past incorrect true benchmark from SV-comp which was caused by a bug
10+
in SSA unwinder where the generated constraints made the analysis unsound.

‎regression/memsafety/built_from_end/test.desc‎

Lines changed: 1 addition & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,6 @@
1-
KNOWNBUG
1+
CORE
22
main.c
33
--heap --intervals --pointer-check --no-assertions
44
^EXIT=0$
55
^SIGNAL=0$
66
^VERIFICATION SUCCESSFUL$
7-
--
8-
--
9-
CBMC 5.9 introduced changes to its implementation of some built-in functions,
10-
the ones affecting this test are malloc and free. Malloc changes have been
11-
already accounted for in 2LS codebase, however the control flow of free
12-
is most likely causing problems in this test making one of the asserts fail:
13-
14-
[main.pointer_dereference.27] dereference failure: deallocated dynamic object in *p: UNKNOWN
15-
16-
This may be related to double free assertion, where GOTO changed from:
17-
18-
...
19-
IF !(__CPROVER_deallocated == ptr) THEN GOTO 6
20-
// 144 file <builtin-library-free> line 18 function free
21-
ASSERT 0 != 0 // double free
22-
// 145 no location
23-
ASSUME 0 != 0
24-
// 146 file <builtin-library-free> line 29 function free
25-
6: _Bool record;
26-
...
27-
28-
to:
29-
ASSERT ptr == NULL || __CPROVER_deallocated != ptr // double free
30-
31-
Note the new ptr == NULL condition, this could be the root cause of
32-
the problem. However further investigation is required
33-
and will be done once the CBMC rebase is completed. According to the
34-
C standard, free(NULL) is a valid construct (no operation) but 2LS doesn't
35-
seem to handle this case correctly.

‎regression/memsafety/double_free/main.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
void *my_malloc(unsigned int size) {
2+
return malloc(size);
3+
}
4+
5+
int main() {
6+
void *a = my_malloc(sizeof(int));
7+
free(a);
8+
free(a);
9+
}

‎regression/memsafety/double_free/test.desc‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
CORE
2+
main.c
3+
--pointer-check --inline
4+
^EXIT=10$
5+
^SIGNAL=0$
6+
^VERIFICATION FAILED$
7+
\[free.precondition.6\] free argument must be NULL or valid pointer: FAILURE

‎regression/memsafety/simple_true/test.desc‎

Lines changed: 1 addition & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,6 @@
1-
KNOWNBUG
1+
CORE
22
main.c
33
--heap --intervals --pointer-check --no-assertions
44
^EXIT=0$
55
^SIGNAL=0$
66
^VERIFICATION SUCCESSFUL$
7-
--
8-
--
9-
CBMC 5.9 introduced changes to its implementation of some built-in functions,
10-
the ones affecting this test are malloc and free. Malloc changes have been
11-
already accounted for in 2LS codebase, however the control flow of free
12-
is most likely causing problems in this test making one of the asserts fail:
13-
14-
[main.pointer_dereference.27] dereference failure: deallocated dynamic object in *p: UNKNOWN
15-
16-
This may be related to double free assertion, where GOTO changed from:
17-
18-
...
19-
IF !(__CPROVER_deallocated == ptr) THEN GOTO 6
20-
// 144 file <builtin-library-free> line 18 function free
21-
ASSERT 0 != 0 // double free
22-
// 145 no location
23-
ASSUME 0 != 0
24-
// 146 file <builtin-library-free> line 29 function free
25-
6: _Bool record;
26-
...
27-
28-
to:
29-
ASSERT ptr == NULL || __CPROVER_deallocated != ptr // double free
30-
31-
Note the new ptr == NULL condition, this could be the root cause of
32-
the problem. However further investigation is required
33-
and will be done once the CBMC rebase is completed. According to the
34-
C standard, free(NULL) is a valid construct (no operation) but 2LS doesn't
35-
seem to handle this case correctly.
36-

‎regression/preconditions/precond_contextsensitive1/test.desc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ main.c
33
--context-sensitive --preconditions
44
^EXIT=5$
55
^SIGNAL=0$
6-
^\[sign\]: sign#return_value#phi20 <= 0 && -\(\(signed __CPROVER_bitvector\[33\]\)sign#return_value#phi20\) <= 0 ==> x <= 0 && -\(\(signed __CPROVER_bitvector\[33\]\)x\) <= 0$
6+
^\[sign\]: sign#return_value#phi21 <= 0 && -\(\(signed __CPROVER_bitvector\[33\]\)sign#return_value#phi21\) <= 0 ==> x <= 0 && -\(\(signed __CPROVER_bitvector\[33\]\)x\) <= 0$

‎src/2ls/2ls_parse_options.cpp‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ Author: Daniel Kroening, Peter Schrammel
2222

2323
#include <ansi-c/ansi_c_language.h>
2424
#include <ansi-c/cprover_library.h>
25+
#include <ansi-c/gcc_version.h>
2526
#include <cpp/cpp_language.h>
2627

2728
#include <goto-programs/goto_convert_functions.h>
@@ -396,6 +397,14 @@ int twols_parse_optionst::doit()
396397

397398
register_languages();
398399

400+
// configure gcc, if required
401+
if(config.ansi_c.preprocessor == configt::ansi_ct::preprocessort::GCC)
402+
{
403+
gcc_versiont gcc_version;
404+
gcc_version.get("gcc");
405+
configure_gcc(gcc_version);
406+
}
407+
399408
if(get_goto_program(options))
400409
return 6;
401410

@@ -1141,6 +1150,12 @@ bool twols_parse_optionst::process_goto_program(
11411150

11421151
remove_dead_goto(goto_model);
11431152

1153+
// There's a bug in SSA creation that causes problems when a single SKIP
1154+
// instruction is a target of both a forward and a backward GOTO.
1155+
// This transformation fixes that by splitting such SKIPs into two.
1156+
// TODO: fix this properly in SSA, if possible.
1157+
fix_goto_targets(goto_model);
1158+
11441159
if(cmdline.isset("competition-mode"))
11451160
{
11461161
limit_array_bounds(goto_model);

‎src/2ls/2ls_parse_options.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,7 @@ class twols_parse_optionst:
197197
void handle_freed_ptr_compare(goto_modelt &goto_model);
198198
void assert_no_builtin_functions(goto_modelt &goto_model);
199199
void assert_no_atexit(goto_modelt &goto_model);
200+
void fix_goto_targets(goto_modelt &goto_model);
200201
};
201202

202203
#endif

0 commit comments

Comments
 (0)